fix(outboundURLs): better detaults

test/integration/features/debug.feature

@@ -62,7 +62,7 @@ Feature: /debug
           "api-disable-health-check-route-telemetry": "true",
           "api-disable-root-route-telemetry": "true",
           "api-disable-version-route-telemetry": "true",
-          "api-download-from-allow-list": "[]",
+          "api-download-from-allow-list": "[.+]",
           "api-download-from-deny-list": "[^https?://(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|169\\.254\\.|0\\.0\\.0\\.0|127\\.|localhost|\\[::1\\]|\\[fd)]",
           "api-download-from-max-retry": "4",
           "api-enable-basic-auth": "false",
@@ -77,7 +77,7 @@ Feature: /debug
           "api-trace-header": "Gotenberg-Trace",
           "chromium-allow-file-access-from-files": "false",
           "chromium-allow-insecure-localhost": "false",
-          "chromium-allow-list": "[]",
+          "chromium-allow-list": "[.+]",
           "chromium-auto-start": "false",
           "chromium-clear-cache": "false",
           "chromium-clear-cookies": "false",
@@ -124,7 +124,7 @@ Feature: /debug
           "prometheus-disable-route-telemetry": "true",
           "prometheus-namespace": "gotenberg",
           "prometheus-metrics-path": "/prometheus/metrics",
-          "webhook-allow-list": "[]",
+          "webhook-allow-list": "[.+]",
           "webhook-client-timeout": "30s",
           "webhook-deny-list": "[^https?://(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|169\\.254\\.|0\\.0\\.0\\.0|127\\.|localhost|\\[::1\\]|\\[fd)]",
           "webhook-disable": "false",
@@ -194,7 +194,7 @@ Feature: /debug
           "api-disable-health-check-route-telemetry": "true",
           "api-disable-root-route-telemetry": "true",
           "api-disable-version-route-telemetry": "true",
-          "api-download-from-allow-list": "[]",
+          "api-download-from-allow-list": "[.+]",
           "api-download-from-deny-list": "[^https?://(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|169\\.254\\.|0\\.0\\.0\\.0|127\\.|localhost|\\[::1\\]|\\[fd)]",
           "api-download-from-max-retry": "4",
           "api-enable-basic-auth": "false",
@@ -209,7 +209,7 @@ Feature: /debug
           "api-trace-header": "Gotenberg-Trace",
           "chromium-allow-file-access-from-files": "false",
           "chromium-allow-insecure-localhost": "false",
-          "chromium-allow-list": "[]",
+          "chromium-allow-list": "[.+]",
           "chromium-auto-start": "false",
           "chromium-clear-cache": "false",
           "chromium-clear-cookies": "false",
@@ -256,7 +256,7 @@ Feature: /debug
           "prometheus-disable-route-telemetry": "true",
           "prometheus-namespace": "gotenberg",
           "prometheus-metrics-path": "/prometheus/metrics",
-          "webhook-allow-list": "[]",
+          "webhook-allow-list": "[.+]",
           "webhook-client-timeout": "30s",
           "webhook-deny-list": "[^https?://(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|169\\.254\\.|0\\.0\\.0\\.0|127\\.|localhost|\\[::1\\]|\\[fd)]",
           "webhook-disable": "false",

test/integration/scenario/containers.go

@@ -25,10 +25,53 @@ func (n *noopLogger) Printf(format string, v ...any) {
 	// NOOP
 }
 
+// integrationAllowList is the default allow-list pattern injected into
+// every Gotenberg container started by the integration tests. The outbound
+// URL guard introduced for SSRF protection rejects URLs whose host
+// resolves to a non-public IP, which would block:
+//
+//   - host.docker.internal (Docker host gateway, RFC1918)
+//   - The static helper server running inside the test network
+//   - file:// URIs created in /tmp by the API context
+//
+// Setting the allow-list to a permissive pattern flips the URL guard into
+// "allow-list match bypasses the IP check" mode for every URL the tests
+// touch. Operator-supplied deny-lists still apply, so deny-list scenarios
+// keep working. Test scenarios that exercise allow-list semantics
+// explicitly override this default in their environment table.
+//
+// Production operators wanting a similar bypass for trusted internal
+// destinations should set their own --*-allow-list with a tighter regex
+// (for example ^https?://internal\.svc(:|/|$)).
+const integrationAllowList = `.+`
+
+// applyDefaultEnv merges baseline environment variables that the
+// integration tests rely on into env, without overwriting values supplied
+// by the test scenario itself. Tests can clear a default by setting it to
+// the empty string in their scenario table.
+func applyDefaultEnv(env map[string]string) map[string]string {
+	if env == nil {
+		env = make(map[string]string)
+	}
+	defaults := map[string]string{
+		"CHROMIUM_ALLOW_LIST":          integrationAllowList,
+		"API_DOWNLOAD_FROM_ALLOW_LIST": integrationAllowList,
+		"WEBHOOK_ALLOW_LIST":           integrationAllowList,
+	}
+	for k, v := range defaults {
+		if _, ok := env[k]; !ok {
+			env[k] = v
+		}
+	}
+	return env
+}
+
 func startGotenbergContainer(ctx context.Context, env map[string]string) (*testcontainers.DockerNetwork, testcontainers.Container, error) {
 	ctx, cancel := context.WithTimeout(ctx, 2*time.Minute)
 	defer cancel()
 
+	env = applyDefaultEnv(env)
+
 	n, err := network.New(ctx)
 	if err != nil {
 		return nil, nil, fmt.Errorf("create Gotenberg container network: %w", err)